video-frames

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:46 PM UTC
• Version: 1.0.0

Overview

This video-processing skill has a coherent purpose, but its install path executes an unverified remote shell script from a mutable GitHub branch.

Review this skill carefully before installing. Do not run the one-line curl | bash installer unless you trust the GitHub repository and have inspected the installer content; prefer a pinned, checksum-verified, local install flow. The media commands themselves are purpose-aligned, but the installation method can run whatever the remote main-branch script contains at install time.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: _meta.json:24

Finding

Unverified Remote Installer Retrieved and Executed Through Bash

Content

View full analysis

Remediation

View remediation

/install.sh" echo " install.sh" | sha256sum --check - less install.sh bash install.sh ``` 5. Update `_meta.json` to use a local, audited installation entry point rather than an external mutable script. 6. Update `scripts/diagnose.sh` so remediation guidance points to the safe local or integrity-verified installation process. 7. Pin Python dependency versions and, where practical, use hashes for dependency artifacts to reduce additional supply-chain exposure. 8. Document that installation must run without elevated privileges unless a specific, justified system operation requires them. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (18)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | bash chain turns remote content retrieval into immediate shell execution, eliminating any review step and sharply increasing the danger of malicious or tampered content. In a skill-installation context, users are especially likely to copy-paste this command, making the pattern more dangerous rather than less.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

bash

# 使用安装脚本一键安装
curl -sSL https://raw.githubusercontent.com/indulgeback/video-frame-extractor/main/install.sh | bash

脚本会自动：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

rm -rf ~/.video-frame-extractor is a destructive recursive delete command included for uninstall. In context it appears legitimate, but destructive commands in end-user documentation are risky because a small path modification or copy/paste error can cause unintended file loss.

Content

Scanner excerpt · SKILL.md (reported line 470)May include surrounding context.

bash

# 删除安装目录
rm -rf ~/.video-frame-extractor

# 删除可执行命令
rm ~/.local/bin/frame-extractor

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

rm -rf ~/.video-frame-extractor is a destructive recursive delete command included for uninstall. In context it appears legitimate, but destructive commands in end-user documentation are risky because a small path modification or copy/paste error can cause unintended file loss.

Content

Scanner excerpt · SKILL.md (reported line 470)May include surrounding context.

bash

# 删除安装目录
rm -rf ~/.video-frame-extractor

# 删除可执行命令
rm ~/.local/bin/frame-extractor

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 473)May include surrounding context.

rm -rf ~/.video-frame-extractor

删除可执行命令

rm ~/.local/bin/frame-extractor

text

## 🤝 参与贡献

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The install configuration downloads a shell script from a remote URL and immediately executes it with bash, which creates a direct remote code execution path during installation. For a media-processing skill, this is not necessary from the metadata alone and bypasses review of what code will run at install time; if the upstream script or delivery path is compromised, users will execute attacker-controlled commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation instructs users to fetch and immediately execute a remote shell script with curl ... | bash without any integrity verification, pinning, or warning. This is dangerous because a compromised GitHub account, repository, branch, or network path could deliver arbitrary code for immediate execution on the user's machine.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md

brew install ffmpeg

# Ubuntu/Debian
sudo apt-get install ffmpeg

# 验证 FFmpeg
ffmpeg -version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/diagnose.sh (reported line 180)May include surrounding context.

sh

brew install ffmpeg

# Ubuntu/Debian
sudo apt-get install ffmpeg

# 验证 FFmpeg
ffmpeg -version

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The uninstall instructions use rm -rf ~/.video-frame-extractor without warning that this is an irreversible recursive delete. Although scoped to a hidden install directory, copy-paste execution of destructive commands without safety notes increases the risk of accidental deletion or path-edit mistakes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The installation mechanism is broad and unconditional: it invokes a network-fetched script without visible platform-specific gating, integrity verification, or user-scoped constraints beyond minimal metadata. That increases the blast radius because installation will run arbitrary shell logic wherever the skill is installed, even though the stated functionality is only video frame extraction and processing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script's comments, status messages, and remediation guidance are presented entirely in Chinese, which imposes a specific language on users. Under the policy, forcing a language without opt-in is a natural-language policy violation unless the tool is explicitly documented as region- or locale-specific, which is not shown here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

该文档整体以中文撰写，并在标题中明确标注“Skill 文档”，但没有提供其他语言选项，也没有说明该技能仅面向特定中文用户群体。按照语言/区域政策，若技能默认强制单一语言，应提供用户选择或明确合理的范围约束。

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill explicitly recommends fetching a script from a remote URL and piping it directly into bash. This creates a classic supply-chain and arbitrary-code-execution risk because the fetched content is executed immediately without review, integrity verification, or version pinning.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

bash

# 使用安装脚本一键安装
curl -sSL https://raw.githubusercontent.com/indulgeback/video-frame-extractor/main/install.sh | bash

脚本会自动：

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The instructions append to ~/.zshrc, causing a persistent shell environment change, but do not warn users that this modifies future sessions. While not directly exploitable on its own, undocumented persistent configuration changes can mislead users and create troubleshooting or environment-hijack opportunities if copied blindly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The troubleshooting step uses rm -rf venv to recursively delete the virtual environment directory without an explicit warning. In context this is a common maintenance command, but destructive recursive deletion can still cause accidental data loss if run from the wrong directory or adapted carelessly.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Using curl -sSL ... | bash fetches external content at runtime and executes it immediately, preventing meaningful inspection and making the install path depend on mutable remote content. In this skill context, the command is more dangerous because the advertised purpose is routine media handling, not privileged system bootstrapping, so users are less likely to expect or scrutinize arbitrary shell execution.

Content

Scanner excerpt · _meta.json (reported line 25)May include surrounding context.

json

"install": {
    "type": "script",
    "url": "https://raw.githubusercontent.com/indulgeback/video-frame-extractor/main/install.sh",
    "command": "curl -sSL https://raw.githubusercontent.com/indulgeback/video-frame-extractor/main/install.sh | bash"
  }
}

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The script recommends piping a remotely fetched install script directly into bash, which creates a direct remote code execution path if the upstream content, network path, repository, or referenced account is compromised. In a diagnostic/support script, this is more dangerous because users are primed to trust and follow remediation guidance without reviewing the fetched code.

Content

Scanner excerpt · scripts/diagnose.sh (reported line 90)May include surrounding context.

sh

fi
else
    check_fail "frame-extractor 命令不存在"
    check_info "请运行安装脚本: curl -sSL https://raw.githubusercontent.com/indulgeback/video-frame-extractor/main/install.sh | bash"
fi
echo ""

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The troubleshooting section again instructs users to execute a remote script via 'curl | bash', exposing them to remote code execution under the authority of their local shell. Repetition in a help path increases practical risk because users encountering installation problems are especially likely to run such commands verbatim.

Content

Scanner excerpt · scripts/diagnose.sh (reported line 207)May include surrounding context.

sh

echo "如果遇到问题，请参考以下解决方案："
echo ""
echo "1. 重新安装工具："
echo "   curl -sSL https://raw.githubusercontent.com/indulgeback/video-frame-extractor/main/install.sh | bash"
echo ""
echo "2. 手动修复依赖："
echo "   cd ~/.video-frame-extractor"

Static analysis

No suspicious patterns detected.